VMware Horizon Community
coley74
Contributor
Contributor

True SSO, SAML, MFA, UPN - failed to obtain sid for user

I am setting up SAML with MFA (from Azure) on the UAG's and then TrueSSO to create the required AD credentials in order to log into horizon without any further user input.

The issue I face is in the AAD, the upn is for example frank@mydomain.com

But in the AD, the upn is frank@something.mydomain.com

After successful SAML & MFA auth, the connection servers fail to log on the user.

The documentation suggests there is a workaround

Identify an AD User That Does not Have an AD UPN

I followed the guide and put in the example, as this looked like it would use sAMAccountName, which in my case is the same 'frank' , however, this didn't make any difference.

Here is a sanitized bit of the log:

[SamlAuthFilter] (SESSION:e694_***_2097) Processing Saml Type-A Assertion

[SamlAuthFilter] (SESSION:e694_***_2097) SAML auth received a valid UPN: frank@mydomain.com

[WinAuthUtils] (SESSION:e694_***_2097) Sending UPN to winauth service: frank@mydomain.com

[ProperoAuthFilter] (SESSION:e694_***_2097) Error performing authentication: Error instantiating PAEContext for frank@mydomain.com: com.vmware.vdi.common.winauth.WinAuthException: Failed to retrieve user information for the users with given upns: Failed to obtain sid for user - sid not available - ErrorCode = 1

[ProperoAuthFilter] (SESSION:e694_***_2097) Error performing authentication com.vmware.vdi.logger.Logger.debug(Logger.java:44)

com.vmware.vdi.broker.filters.FatalAuthException: Error instantiating PAEContext for frank@mydomain.com: com.vmware.vdi.common.winauth.WinAuthException: Failed to retrieve user information for the users with given upns: Failed to obtain sid for user - sid not available - ErrorCode = 1

Can anybody suggest if what I'd like to is feasible, and if possible offer some suggestions on the pae-LDAPURLList filter from the documentation.

Reply
0 Kudos
2 Replies
DobbsActual
Contributor
Contributor

Did you ever find a solution to this issue? We're running into the same errors, but under a slightly different scenario. SAML is coming in via WS1 access with UAGs in passthrough, but the authentication fails and the logs show the same exact errors you shared in your message. 

We're setup to use TrueSSO but since the connection server can't obtain/resolve a SID, the TrueSSO flow isn't even able to start. 

Reply
0 Kudos
axfere
Contributor
Contributor

Hi,

have you ever fixed the issue?

AxFere

Reply
0 Kudos